v0.1.29 — Geraete-Offboarding (v1)

Neu:
- Geraete-Offboarding: Geraete ueber Intune, Autopilot und Entra ID
  entfernen. Suche + ID-Aufloesung (via $batch), Recovery-Keys
  (BitLocker/FileVault/LAPS) vor dem Loeschen, Bestaetigungs-Dialog mit
  Dienst-Auswahl + 403/Multi-Admin-Approval-Handling, im Read-Only gesperrt.
  Neues Modul src/Offboard.ps1, Endpoints /api/offboard/{search,keys,execute}.
  Portiert aus Device Offboarding Manager (Ugur Koc, MIT).
- Offboarding-Berechtigungen dokumentiert; Setup-Skript -IncludeOffboarding.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

www/app.js

@@ -4621,6 +4621,7 @@ function switchMainView(view) {
   const reportView = document.getElementById('appReportView');
   const devView    = document.getElementById('devView');
   const polView    = document.getElementById('policiesView');
+  const offView    = document.getElementById('offView');
   document.querySelectorAll('#topbarNav .nav-tab').forEach(t => {
     t.classList.toggle('active', t.dataset.view === view);
     t.setAttribute('aria-selected', t.dataset.view === view ? 'true' : 'false');
@@ -4630,12 +4631,13 @@ function switchMainView(view) {
   reportView.classList.toggle('hidden', view !== 'report');
   devView   .classList.toggle('hidden', view !== 'devices');
   polView   .classList.toggle('hidden', view !== 'policies');
+  if (offView) offView.classList.toggle('hidden', view !== 'offboard');
 }
 
 document.querySelectorAll('#topbarNav .nav-tab').forEach(btn => {
   btn.addEventListener('click', () => {
     const view = btn.dataset.view;
-    if ((view === 'groups' || view === 'report' || view === 'devices' || view === 'policies') && !State.connected) {
+    if ((view === 'groups' || view === 'report' || view === 'devices' || view === 'policies' || view === 'offboard') && !State.connected) {
       toast('Bitte zuerst verbinden.', 'warn');
       return;
     }
@@ -4644,6 +4646,7 @@ document.querySelectorAll('#topbarNav .nav-tab').forEach(btn => {
     if (view === 'report' && ReportState.items.length === 0) loadAppReport();
     if (view === 'devices') { devLoadAll(); setTimeout(() => document.getElementById('devSearch').focus(), 80); }
     if (view === 'policies' && PolState.items.length === 0) loadPolicies();
+    if (view === 'offboard') setTimeout(() => document.getElementById('offSearch').focus(), 80);
   });
 });
 
@@ -6215,3 +6218,172 @@ document.querySelectorAll('#polTable th.sortable').forEach(th => {
     renderPolicies();
   });
 });
+
+// =============================================================
+// OFFBOARDING: Geräte aus Intune / Autopilot / Entra entfernen
+// =============================================================
+const OffState = { items: [], selected: new Set() };
+function offKey(d) { return d.intuneDeviceId; }
+function offSelectedDevices() { return OffState.items.filter(d => OffState.selected.has(offKey(d))); }
+
+async function offSearch() {
+  const q = document.getElementById('offSearch').value.trim();
+  const type = document.getElementById('offSearchType').value;
+  if (q.length < 2) { toast('Mindestens 2 Zeichen.', 'warn'); return; }
+  const body = document.getElementById('offBody');
+  body.innerHTML = `<tr><td colspan="7" class="pol-hint"><span class="spinner" style="width:14px;height:14px;border-width:2px;"></span> Suche…</td></tr>`;
+  try {
+    const res = await api(`/api/offboard/search?query=${encodeURIComponent(q)}&type=${type}`, { timeoutMs: 60000 });
+    OffState.items = res.items || [];
+    OffState.selected = new Set();
+    renderOff();
+  } catch (e) {
+    toast('Suche fehlgeschlagen: ' + e.message, 'err');
+    body.innerHTML = `<tr><td colspan="7" class="pol-empty">Fehler bei der Suche.</td></tr>`;
+  }
+}
+
+function offSvcBadges(d) {
+  const b = [];
+  if (d.inIntune)    b.push('<span class="off-badge">Intune</span>');
+  if (d.inEntra)     b.push('<span class="off-badge">Entra</span>');
+  if (d.inAutopilot) b.push('<span class="off-badge">Autopilot</span>');
+  if (d.coManaged)   b.push('<span class="off-badge warn">Co-Mgmt</span>');
+  return b.join(' ') || '—';
+}
+
+function renderOff() {
+  const body = document.getElementById('offBody');
+  if (!OffState.items.length) {
+    body.innerHTML = `<tr><td colspan="7" class="pol-empty">Keine Geräte gefunden.</td></tr>`;
+    offUpdateSel();
+    return;
+  }
+  body.innerHTML = OffState.items.map(d => {
+    const k = offKey(d);
+    const checked = OffState.selected.has(k) ? 'checked' : '';
+    return `<tr data-key="${escapeHtml(k)}">
+      <td><input type="checkbox" class="off-row-check" data-key="${escapeHtml(k)}" ${checked}></td>
+      <td>${escapeHtml(d.deviceName || '—')}</td>
+      <td>${escapeHtml(d.serialNumber || '—')}</td>
+      <td>${escapeHtml(((d.operatingSystem || '') + ' ' + (d.osVersion || '')).trim() || '—')}</td>
+      <td>${escapeHtml(d.primaryUser || '—')}</td>
+      <td>${polFmtDate(d.lastSync)}</td>
+      <td>${offSvcBadges(d)}</td>
+    </tr>`;
+  }).join('');
+  body.querySelectorAll('.off-row-check').forEach(cb => {
+    cb.addEventListener('change', () => {
+      if (cb.checked) OffState.selected.add(cb.dataset.key); else OffState.selected.delete(cb.dataset.key);
+      offUpdateSel();
+    });
+  });
+  body.querySelectorAll('tr[data-key]').forEach(tr => {
+    tr.addEventListener('click', e => {
+      if (e.target.classList.contains('off-row-check')) return;
+      const cb = tr.querySelector('.off-row-check');
+      cb.checked = !cb.checked;
+      cb.dispatchEvent(new Event('change'));
+    });
+  });
+  offUpdateSel();
+}
+
+function offUpdateSel() {
+  const n = OffState.selected.size;
+  document.getElementById('offSelCount').textContent = `${n} ausgewählt`;
+  document.getElementById('offBtn').disabled = n === 0;
+}
+
+function openOffboardModal() {
+  const devs = offSelectedDevices();
+  if (!devs.length) return;
+  document.getElementById('offConfirmList').innerHTML = devs.map(d => `
+    <div class="off-confirm-row"><b>${escapeHtml(d.deviceName || '—')}</b>
+      — Intune: ${d.intuneDeviceId ? '✓' : '–'}, Entra: ${d.entraObjectId ? '✓' : '–'}, Autopilot: ${d.autopilotId ? '✓' : '–'}</div>
+  `).join('');
+  document.getElementById('offModalInfo').textContent = `${devs.length} Gerät(e)`;
+  document.getElementById('offConfirmChk').checked = false;
+  document.getElementById('offExecuteBtn').disabled = true;
+  document.getElementById('offResults').innerHTML = '';
+  document.getElementById('offKeys').innerHTML = '<div class="lbl">Recovery-Keys</div><div class="muted">Wird geladen…</div>';
+  openModal('modalOffboard');
+  offLoadKeys(devs);
+}
+
+async function offLoadKeys(devs) {
+  const box = document.getElementById('offKeys');
+  const parts = [];
+  for (const d of devs) {
+    try {
+      const res = await api('/api/offboard/keys', {
+        method: 'POST',
+        body: { intuneDeviceId: d.intuneDeviceId, azureADDeviceId: d.azureADDeviceId, operatingSystem: d.operatingSystem },
+        timeoutMs: 60000,
+      });
+      const k = res.keys || {};
+      let html = `<div class="off-key-dev"><b>${escapeHtml(d.deviceName || '—')}</b>`;
+      (k.bitlocker || []).forEach(b => { html += `<div class="off-key">BitLocker${b.volumeType ? ' (' + escapeHtml(b.volumeType) + ')' : ''}: <code>${escapeHtml(b.key)}</code></div>`; });
+      if (k.fileVault) html += `<div class="off-key">FileVault: <code>${escapeHtml(k.fileVault)}</code></div>`;
+      if (k.laps) html += `<div class="off-key">LAPS${k.laps.account ? ' (' + escapeHtml(k.laps.account) + ')' : ''}: <code>${escapeHtml(k.laps.password)}</code></div>`;
+      if (k.notes && k.notes.length) html += `<div class="muted">${k.notes.map(escapeHtml).join(' · ')}</div>`;
+      html += '</div>';
+      parts.push(html);
+    } catch (e) {
+      parts.push(`<div class="off-key-dev"><b>${escapeHtml(d.deviceName || '—')}</b> <span class="muted">Keys-Fehler: ${escapeHtml(e.message)}</span></div>`);
+    }
+  }
+  box.innerHTML = `<div class="lbl">🔑 Recovery-Keys — vor dem Löschen sichern!</div>${parts.join('')}`;
+}
+
+async function offExecute() {
+  const devs = offSelectedDevices();
+  if (!devs.length) return;
+  const services = {
+    entra:     document.querySelector('input[name="offEntra"]:checked').value,
+    intune:    document.getElementById('offSvcIntune').checked,
+    autopilot: document.getElementById('offSvcAutopilot').checked,
+  };
+  if (services.entra === 'none' && !services.intune && !services.autopilot) {
+    toast('Keinen Dienst ausgewählt.', 'warn');
+    return;
+  }
+  const payload = devs.map(d => ({
+    deviceName: d.deviceName, intuneDeviceId: d.intuneDeviceId,
+    entraObjectId: d.entraObjectId, autopilotId: d.autopilotId,
+  }));
+  document.getElementById('offExecuteBtn').disabled = true;
+  setLoading('Offboarding läuft…');
+  try {
+    const res = await api('/api/offboard/execute', { method: 'POST', body: { devices: payload, services }, timeoutMs: 180000 });
+    const results = res.results || [];
+    document.getElementById('offResults').innerHTML =
+      `<div class="lbl">Ergebnis (${res.successCount}/${res.total})</div>` +
+      results.map(r => `<div class="off-result ${r.success ? 'ok' : 'fail'}">${r.success ? '✓' : '✗'} ${escapeHtml(r.deviceName)} — ${escapeHtml(r.service)} ${escapeHtml(r.action)}${r.error ? ': ' + escapeHtml(r.error) : ''}</div>`).join('');
+    toast(`${res.successCount}/${res.total} Aktionen erfolgreich.`, res.successCount === res.total ? 'ok' : 'warn', 'Offboarding');
+    // Erfolgreich vollständig offgeboardete Geräte aus der Liste nehmen.
+    const doneNames = new Set(results.filter(r => r.success).map(r => r.deviceName));
+    if (doneNames.size) {
+      OffState.items = OffState.items.filter(d => !doneNames.has(d.deviceName) || results.some(r => r.deviceName === d.deviceName && !r.success));
+      OffState.selected = new Set();
+      renderOff();
+    }
+  } catch (e) {
+    toast('Offboarding fehlgeschlagen: ' + e.message, 'err');
+    document.getElementById('offExecuteBtn').disabled = false;
+  } finally {
+    clearLoading();
+  }
+}
+
+document.getElementById('offSearchBtn')?.addEventListener('click', offSearch);
+document.getElementById('offSearch')?.addEventListener('keydown', e => { if (e.key === 'Enter') offSearch(); });
+document.getElementById('offCheckAll')?.addEventListener('change', e => {
+  OffState.items.forEach(d => { const k = offKey(d); if (e.target.checked) OffState.selected.add(k); else OffState.selected.delete(k); });
+  renderOff();
+});
+document.getElementById('offBtn')?.addEventListener('click', openOffboardModal);
+document.getElementById('offConfirmChk')?.addEventListener('change', e => {
+  document.getElementById('offExecuteBtn').disabled = !e.target.checked;
+});
+document.getElementById('offExecuteBtn')?.addEventListener('click', offExecute);